Low-Cost Android Phones Ship With Preinstalled Malware Turning Devices Into Residential Proxies

Bitdefender researchers have identified a supply chain attack affecting low-cost Android smartphones shipped with malware baked into the device firmware. The threat actor, tracked as Midnight Mimosa, targets Android devices built on MediaTek platforms across multiple brands. The malicious software enables covert app installation, advertising fraud, and the use of compromised devices as residential proxies without the user's knowledge or consent.

The malware is embedded at the firmware level, meaning it activates automatically during the initial setup of the device. No further user interaction is required beyond the initial configuration. The preinstalled software facilitates covert app installation and ad fraud, and turns the device into a residential proxy, routing traffic through the compromised device.

Bitdefender notes that the attack exploits the supply chain, with malware present before the device reaches the end user. Specific brand names and exact victim counts have not been disclosed in the available summary. The firm recommends that users verify device integrity, avoid sideloading apps from untrusted sources, and apply any available security updates from manufacturers. As of the report date, no universal firmware patch is available, as the issue stems from a compromise at the manufacturing or distribution stage.